Hacker News Reader

Hacker News

Comment by jsgyx | Hacker News Reader

Full thread

jsgyx

I use NoScript, you can't see shit.

View on HN

Here's a port scanning technique that doesn't use javascript:

https://blog.jeremiahgrossman.com/2006/11/browser-port-scann...

This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.

> This is not helpful, because only an extremely small proportion of Web users run NoScript, and nor should they have to.

Most (non-technical) Web users also don't run their own web servers, so they aren't affected. Among technical users, the proportion with NoScript is probably not as small.

Most users have a modem or router that comes with a web interface, like just about everything in the internet of things.

Their routers do, along with an ever growing number of IoT devices people happily hook up to their WiFi without a second thought.

Given the long and gory history of companies releasing insecure by default devices methods like this are a legitimate entry point into a network.

That's like saying that people shouldn't have to run ad blockers, that instead ad networks should behave. Sit and wait.

You can't see shit neither

yes, he can, he will see the modern equivalent of "This site is best viewed in Internet Explorer". Which in 2019 becomes "Please enable Javascript to view this page"

Honestly, such notices are shockingly unusual - most of the time (at least for the sites I encounter) they don't bother with <noscript>, you just get a broken and/or blank page.

I mostly use the web for reading blogs and articles, so the loss of dynamic sites isn't troublesome, but it's certainly not for most users.

(Edit: Some numerical context I have enabled Javascript for 194 sites over the last five years, whereas I encounter several new sites daily.)

I also browse with noscript all the time and I get them quite often. Mostly on product landing pages and Show HN demos.

Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view.

> Hmm, I wonder if it's confirmation bias on my end, or just a difference in what pages we each view.

Yes.

Joking aside, I will add that I've been a NoScript/FlashBlock user for quite some time (more than a decade? I honestly can't remember), and while I run into some things that are frustrating (just had to disable NoScript for a tab to order plane tickets), it is refreshingly uncommon.

Yes, you can browse with default deny to JS and Flash.

That was actually funny

Actually, they can: even if you enable JS, NoScript's ABE will prevent this attack: https://en.wikipedia.org/wiki/NoScript#Application_Boundarie...

Not anymore. It's not included in modern versions (after the changes in Add-Ons for Firefox's Quantum update).

Reply on news.ycombinator.com